From 4cce36f7698f6b7705086de72a88747d8cb89833 Mon Sep 17 00:00:00 2001 From: Andrei Vorobev <738482+vorobey@users.noreply.github.com> Date: Wed, 4 Nov 2026 10:08:57 +0200 Subject: [PATCH 1/3] security: Override minimatch 9.x/10.x to 11.0.1 (GHSA-g3hv-75wg-m249) --- pnpm-lock.yaml | 40 ++++++++++++++++------------------------ pnpm-workspace.yaml | 1 + 2 files changed, 17 insertions(+), 24 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6b32589e9..debf58eba 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,7 @@ settings: overrides: cross-spawn: 7.0.6 + minimatch@>=9.0.0 <11.0.1: ^11.0.1 importers: @@ -349,6 +350,9 @@ packages: resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==} engines: {node: '>=18.18'} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@jridgewell/resolve-uri@3.1.2': resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==} engines: {node: '>=6.0.0'} @@ -826,9 +830,6 @@ packages: brace-expansion@1.1.21: resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@2.1.7: - resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.12: resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} @@ -1735,17 +1736,13 @@ packages: resolution: {integrity: sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==} engines: {node: '>=18'} - minimatch@10.2.5: - resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==} - engines: {node: 18 || 20 || >=22} + minimatch@11.0.4: + resolution: {integrity: sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==} + engines: {node: 20 || >=22} minimatch@3.1.5: resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minimatch@9.0.9: - resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==} - engines: {node: '>=16 || 14 >=14.17'} - minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -2703,6 +2700,8 @@ snapshots: '@humanwhocodes/retry@0.4.3': {} + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@jridgewell/resolve-uri@3.1.2': {} '@jridgewell/sourcemap-codec@1.6.0': {} @@ -3022,7 +3021,7 @@ snapshots: '@typescript-eslint/types': 8.61.1 '@typescript-eslint/visitor-keys': 8.61.1 debug: 4.4.3 - minimatch: 10.2.5 + minimatch: 11.0.4 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@4.9.5) @@ -3037,7 +3036,7 @@ snapshots: '@typescript-eslint/types': 8.63.0 '@typescript-eslint/visitor-keys': 8.63.0 debug: 4.4.3 - minimatch: 10.2.5 + minimatch: 11.0.4 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@4.9.5) @@ -3052,7 +3051,7 @@ snapshots: '@typescript-eslint/types': 8.63.0 '@typescript-eslint/visitor-keys': 8.63.0 debug: 4.4.3 - minimatch: 10.2.5 + minimatch: 11.0.4 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@5.6.3) @@ -3067,7 +3066,7 @@ snapshots: '@typescript-eslint/types': 8.63.0 '@typescript-eslint/visitor-keys': 8.63.0 debug: 4.4.3 - minimatch: 10.2.5 + minimatch: 11.0.4 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@6.0.3) @@ -3274,10 +3273,6 @@ snapshots: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.7: - dependencies: - balanced-match: 1.0.2 - brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -3605,7 +3600,7 @@ snapshots: get-tsconfig: 4.14.0 globals: 15.15.0 ignore: 5.3.2 - minimatch: 9.0.9 + minimatch: 11.0.4 semver: 7.8.5 eslint-plugin-react-hooks@5.2.0(eslint@9.39.4): @@ -4260,18 +4255,15 @@ snapshots: mimic-function@5.0.1: {} - minimatch@10.2.5: + minimatch@11.0.4: dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: brace-expansion: 1.1.21 - minimatch@9.0.9: - dependencies: - brace-expansion: 2.1.7 - minimist@1.2.8: {} mitt@3.0.1: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 2ee7523d8..04b6d927b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,3 +9,4 @@ allowBuilds: overrides: cross-spawn: 7.0.6 + "minimatch@>=9.0.0 <11.0.1": ^11.0.1 From f8312aa3aed79ec83b70c8cc79998a0d640a7bfd Mon Sep 17 00:00:00 2001 From: Andrei Vorobev <738482+vorobey@users.noreply.github.com> Date: Wed, 4 Nov 2026 15:28:08 +0200 Subject: [PATCH 2/3] chore: add wide override for minimatch --- pnpm-workspace.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 04b6d927b..3a64fc2af 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,4 +9,4 @@ allowBuilds: overrides: cross-spawn: 7.0.6 - "minimatch@>=9.0.0 <11.0.1": ^11.0.1 + "minimatch@<11.0.1": ^11.0.1 From 2a5776c4d5389c389dc41baac4454f5f75507962 Mon Sep 17 00:00:00 2001 From: Andrei Vorobev <738482+vorobey@users.noreply.github.com> Date: Wed, 4 Nov 2026 16:29:43 +0200 Subject: [PATCH 3/3] lock update --- pnpm-lock.yaml | 39 +++++++-------------------------------- 1 file changed, 7 insertions(+), 32 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index debf58eba..210716e2b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: cross-spawn: 7.0.6 - minimatch@>=9.0.0 <11.0.1: ^11.0.1 + minimatch@<11.0.1: ^11.0.1 importers: @@ -817,9 +817,6 @@ packages: resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==} engines: {node: '>= 0.4'} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -827,9 +824,6 @@ packages: boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} - brace-expansion@1.1.21: - resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@5.0.12: resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} @@ -909,9 +903,6 @@ packages: resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==} engines: {node: '>= 0.8'} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - concat-stream@1.6.2: resolution: {integrity: sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==} engines: {'0': node >= 0.8} @@ -1740,9 +1731,6 @@ packages: resolution: {integrity: sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==} engines: {node: 20 || >=22} - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -2633,7 +2621,7 @@ snapshots: dependencies: '@eslint/object-schema': 2.1.7 debug: 4.4.3 - minimatch: 3.1.5 + minimatch: 11.0.4 transitivePeerDependencies: - supports-color @@ -2654,7 +2642,7 @@ snapshots: ignore: 5.3.2 import-fresh: 3.3.1 js-yaml: 4.3.2 - minimatch: 3.1.5 + minimatch: 11.0.4 strip-json-comments: 3.1.1 transitivePeerDependencies: - supports-color @@ -3262,17 +3250,10 @@ snapshots: axobject-query@4.1.0: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} boolbase@1.0.0: {} - brace-expansion@1.1.21: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -3349,8 +3330,6 @@ snapshots: dependencies: delayed-stream: 1.0.0 - concat-map@0.0.1: {} - concat-stream@1.6.2: dependencies: buffer-from: 1.1.2 @@ -3619,7 +3598,7 @@ snapshots: estraverse: 5.3.0 hasown: 2.0.4 jsx-ast-utils: 3.3.5 - minimatch: 3.1.5 + minimatch: 11.0.4 object.entries: 1.1.9 object.fromentries: 2.0.8 object.values: 1.2.1 @@ -3641,7 +3620,7 @@ snapshots: estraverse: 5.3.0 hasown: 2.0.3 jsx-ast-utils: 3.3.5 - minimatch: 3.1.5 + minimatch: 11.0.4 object.entries: 1.1.9 object.fromentries: 2.0.8 object.values: 1.2.1 @@ -3734,7 +3713,7 @@ snapshots: is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 lodash.merge: 4.6.2 - minimatch: 3.1.5 + minimatch: 11.0.4 natural-compare: 1.4.0 optionator: 0.9.4 transitivePeerDependencies: @@ -3872,7 +3851,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.5 + minimatch: 11.0.4 once: 1.4.0 path-is-absolute: 1.0.1 @@ -4260,10 +4239,6 @@ snapshots: '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.21 - minimist@1.2.8: {} mitt@3.0.1: {}